"""Flask test client / real-DB integration tests for the per-client ICS
calendar feed (#22): each client's clients.ics_token gates and scopes
/api/bookings.ics, replacing the old shared ICS_TOKEN + client_id query
param. Same testing decision as #20/#21: assert on HTTP response + DB state.
"""
from datetime import datetime, timedelta, timezone

import pytest

import booking_db as bdb
from app import app as flask_app

CLIENT_A = "C-TEST-ICS-A"
CLIENT_B = "C-TEST-ICS-B"


@pytest.fixture
def client():
    flask_app.config["TESTING"] = True
    flask_app.secret_key = "test-secret"
    return flask_app.test_client()


def _setup(client_id, business_name):
    with bdb.db.connect() as conn, conn.cursor() as cur:
        cur.execute(
            "INSERT INTO clients (client_id, business_name, timezone, auto_confirm, ics_token) "
            "VALUES (%s, %s, %s, %s, NULL) ON CONFLICT (client_id) DO UPDATE SET "
            "business_name = EXCLUDED.business_name, ics_token = NULL",
            (client_id, business_name, "Europe/Berlin", True))
        conn.commit()
    location = bdb.create_location(client_id, "Main")
    resource = bdb.create_resource(client_id, location["location_id"], "Chair 1")
    start = datetime.now(timezone.utc).replace(microsecond=0) + timedelta(days=1)
    booking = bdb.create_booking(
        client_id, resource["resource_id"], "Ivy", "ivy@example.com",
        "Haircut", start, start + timedelta(minutes=30))
    return resource, booking


def _login(client, client_id, email="owner@example.com", password="correct horse"):
    bdb.create_user(client_id, email, password)
    client.post("/owner/login", data={"email": email, "password": password})


# ---- token gating ----

def test_missing_token_is_forbidden(client):
    _setup(CLIENT_A, "Happy Nails")
    resp = client.get("/api/bookings.ics")
    assert resp.status_code == 403


def test_bogus_token_is_forbidden(client):
    _setup(CLIENT_A, "Happy Nails")
    resp = client.get("/api/bookings.ics", query_string={"token": "not-a-real-token"})
    assert resp.status_code == 403


def test_valid_token_returns_only_that_clients_bookings(client):
    _setup(CLIENT_A, "Happy Nails")
    _setup(CLIENT_B, "Cafe Lichtblick")
    token_a = bdb.ensure_ics_token(CLIENT_A)
    resp = client.get("/api/bookings.ics", query_string={"token": token_a})
    assert resp.status_code == 200
    body = resp.get_data(as_text=True)
    assert "Ivy" in body
    assert CLIENT_A in body
    assert CLIENT_B not in body


def test_swapping_client_id_query_param_has_no_effect(client):
    """The old feed let any token holder view another client's bookings by
    changing client_id -- the new feed resolves the client from the token
    alone, so a client_id param (even another tenant's) is simply ignored."""
    _setup(CLIENT_A, "Happy Nails")
    resource_b, booking_b = _setup(CLIENT_B, "Cafe Lichtblick")
    token_a = bdb.ensure_ics_token(CLIENT_A)
    resp = client.get("/api/bookings.ics", query_string={
        "token": token_a, "client_id": CLIENT_B})
    assert resp.status_code == 200
    body = resp.get_data(as_text=True)
    assert CLIENT_B not in body
    assert CLIENT_A in body


# ---- token provisioning ----

def test_ensure_ics_token_generates_and_persists(client):
    _setup(CLIENT_A, "Happy Nails")
    assert bdb.get_client(CLIENT_A)["ics_token"] is None
    token = bdb.ensure_ics_token(CLIENT_A)
    assert token
    assert bdb.get_client(CLIENT_A)["ics_token"] == token


def test_ensure_ics_token_is_stable_across_calls(client):
    _setup(CLIENT_A, "Happy Nails")
    first = bdb.ensure_ics_token(CLIENT_A)
    second = bdb.ensure_ics_token(CLIENT_A)
    assert first == second


def test_ensure_ics_token_differs_per_client(client):
    _setup(CLIENT_A, "Happy Nails")
    _setup(CLIENT_B, "Cafe Lichtblick")
    assert bdb.ensure_ics_token(CLIENT_A) != bdb.ensure_ics_token(CLIENT_B)


# ---- owner dashboard surfacing ----

def test_settings_page_shows_subscribe_url_with_own_token(client):
    _setup(CLIENT_A, "Happy Nails")
    _login(client, CLIENT_A)
    resp = client.get("/owner/settings")
    assert resp.status_code == 200
    body = resp.get_data(as_text=True)
    token = bdb.get_client(CLIENT_A)["ics_token"]
    assert token
    assert f"token={token}" in body
    assert "bookings.ics" in body